CVE-2026-64298: In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask fo
Summary
A security vulnerability in the Linux kernel's NFSv4 (a network file system protocol) was found where the permission check for opening files with truncation (O_TRUNC, which deletes file contents) did not properly require write permission. This allowed users to truncate files they couldn't normally write to, violating POSIX standards (the portable operating system interface standard). The fix ensures that write permission is checked whenever O_TRUNC is used, matching what a standard server would enforce.
Solution / Mitigation
Include MAY_WRITE in the permission mask whenever O_TRUNC is set in the nfs_open_permission_mask() function so the local permission check matches the access the server would have enforced.
Vulnerability Details
EPSS: 0.0%
July 25, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64298
First tracked: July 25, 2026 at 08:10 AM
Classified by LLM (prompt v3) · confidence: 95%